ci: stop image compression bot from self-triggering PR loops (#3996)

* ci(optimize-images): update image compression workflow

- Add support for webp and avif image formats.
- Upgrade calibreapp/image-actions to version 1.5.0.
- Enhance concurrency settings for better performance.
- Refine conditions for running on pull requests.

* ci: use github token for PR image compression

* fix(ci): prevent image compression loop with job-level actor check

Replace GITHUB_TOKEN conditional switching with a simpler job-level if
guard. The previous approach used GITHUB_TOKEN for PR runs, which
prevented the loop but blocked required status checks (main.yml) from
running on bot commits, making PRs unmergeable for non-admin contributors.

The job now skips entirely when the bot's own compression commit
re-triggers it (synchronize + bot actor), breaking the infinite loop.
Bot-authored PRs (e.g. GTN imports) are unaffected because they trigger
as 'opened', not 'synchronize'.

Also adds:
- persist-credentials: false (zizmor artipacked fix)
- Scoped permissions on App token step (zizmor github-app fix)

---------

Co-authored-by: Arash <arash77.kad@gmail.com>

Author: itisAliRH

.github/workflows/optimize-images.yml

@@ -8,49 +8,67 @@
 name: Compress images
 on:
   pull_request:
+    types:
+      - opened
+      - synchronize
     paths:
       - "**.jpg"
       - "**.jpeg"
       - "**.png"
+      - "**.webp"
+      - "**.avif"
   push:
     branches:
       - main
     paths:
       - "**.jpg"
       - "**.jpeg"
       - "**.png"
+      - "**.webp"
+      - "**.avif"
   workflow_dispatch:
   schedule:
     - cron: "00 23 * * 0"
+concurrency:
+  group: compress-images-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   build:
     name: calibreapp/image-actions
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
-    # Only run on main repo on and PRs that match the main repo.
+    # Only run on main repo and on PRs that match the main repo.
+    # Skip when the bot's own compression commit re-triggers this workflow
+    # (synchronize + bot actor) to break the infinite loop. Safe for
+    # bot-authored PRs (e.g. GTN imports) because those trigger as
+    # 'opened', not 'synchronize'.
     if: |
       github.repository == 'galaxyproject/galaxy-hub' &&
       (github.event_name != 'pull_request' ||
-       github.event.pull_request.head.repo.full_name == github.repository)
+       github.event.pull_request.head.repo.full_name == github.repository) &&
+      !(github.event_name == 'pull_request' && github.event.action == 'synchronize' && startsWith(github.actor, 'galaxy-hub-bot'))
     steps:
       - name: Checkout Branch
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Generate GitHub App token
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
           client-id: ${{ secrets.HUB_BOT_APP_CLIENT_ID }}
           private-key: ${{ secrets.HUB_BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-metadata: read
       - name: Compress Images
         id: calibre
-        uses: calibreapp/image-actions@1.4.1
+        uses: calibreapp/image-actions@1.5.0
         with:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          # Attempt to prevent webp recompression by minimizing diff.
           webpQuality: '90'
-          minPctChange: '2.5'
           # Non-PR events need compress-only mode so create-pull-request can publish the result.
           compressOnly: ${{ github.event_name != 'pull_request' }}
       - name: Create Pull Request